Wireless communication technologies have seen tremendous growth in the last few years. This growth has been fueled in part by the freedom of movement offered by wireless technologies and the greatly improved quality of voice and data communications over the wireless medium. Improved quality of voice services along with the addition of data services have had and will continue to have a significant effect on the communicating public. The additional services include accessing the Internet using a mobile device while roaming.
The ability to maintain a data session while moving is important to both users and system operators. As more users utilize mobile internet protocol operations a user may want to have simultaneous access to the same packet data interworking function using dual stack operation, which allows simultaneous use of two version of a mobile internet protocol. The packet data interworking function (PDIF) acts as a security gateway protecting the cellular network.
FIG. 1 shows an interworking architecture for a wireless local area network (WLAN). The network may be part of a wireless communication system operating on the 3GPP2 standard defined by the standard offered by a consortium named “3rd Generation Partnership Project 2” referred to herein as 3GPP2. The architecture, 100, includes a mobile station (MS), 102, connected to a WLAN system, 104. The WLAN system, 104 includes the Access Point (AP) 106, and Access Router (AR) 108. The WLAN system is connected to the 3G Home Network 110. The WLAN system connects to the 3G Home Network 110 via the Packet Data Interworking Function (PDIF) 122. The PDIF 114 is connected to the Home Authentication, Authorization, and Accounting (H-AAA) device 112.
The MS establishes a secure IP tunnel with the PDIF, which acts as a security gateway in the 3G Home Network. The tunnel establishment is authenticated and authorized by the H-AAA 112. After the tunnel has been established, the MS may access services in the 3G Home Network 110. The dashed line in FIG. 1 indicates the path for Authentication, Authorization, and Accounting information and indicates information transfer between H-AAA 112 and PDIF 114. The solid lines show the bearer path for user data traffic and the pipeline indicates the secure tunnel protecting the user data traffic between the MS 102 and the PDIF 114.
The MS is pre-configured with the PDIF address information, either an IP address or a Fully Qualified Domain Name (FQDN). If the MS is configured with the PDIF's FQDN, the MS will relay on the Domain Name System (DNS) to resolve the IP address associated with the FQDN. The MS uses Internet Key Exchange version 2 (IKEv2) to establish secure tunnels, known as IP-sec tunnels for data transfer, with the PIDF. Part of establishing a secure tunnel requires that the MS be authenticated and authorized by the H-AAA, 112 in FIG. 1. The MS may use a number of procedures for mutual authentication. The authentication information, including credentials and random challenges, are transported in Extensible Authentication Protocol (EAP) messages exchanged between the MS and H-AAA. The EAP messages are transported in the IKEv2 messages between the MS and the PDIF, and also in the RADIUS messages exchanged between the PDIF and H-AAA.
The MS may desire simultaneous access to the same PDIF using both IPv4 and IPv6. This dual stack operation poses authorization problems for the PDIF, namely, the PDIF needs to know whether a MS is authorized for IPv4 and/or IPv6. Additionally, the PDIF needs to indicate to the MS that the MS is not authorized for one of the IP versions, in the case of an MS requesting dual stack operation that is not authorized for both IPv4 and IPv6. There is a need for a method and apparatus to indicate IP authorization to a MS and also to indicate to a MS that the MS is not authorized for both IP versions.